North Korea Binance Hack: 44% Frozen, $3.24B Still Unmoved
North Korea Binance Hack: $3.24B Unmoved as Coinjoin Mixing Begins
The largest crypto theft on record is entering a new phase. In the North Korea Binance hack, $6.43 billion was stolen on 29 October, and by 2 November, about $2.85 billion, or 44%, had been frozen or seized.
Roughly $3.24 billion still sits in addresses linked to the theft, while the thieves have used about 12,000 wallets and more than 40,000 transactions across 11 blockchains.
For the first time, they have also started mixing bitcoin through a privacy tool called a coinjoin. Here is what is known, in plain words.
Source: WuBlockchain on X
What Happened on 29 October
The theft ran from 20:05 to 23:56 UTC on 29 October and touched 11 different blockchains.
In its first security update, the exchange said the attack may have started with a compromised engineer’s laptop, which let an attacker reach a service and submit unauthorized withdrawals.
It reported no evidence of a leaked wallet key, put the impact near $6.3 billion, and said about $3 billion was already frozen.
Withdrawals were paused, and the company promised to cover all losses from its SAFU fund, an emergency reserve, and its own money. Deposits were never affected.
Blockchain analysts attribute the attack to North Korea, as this earlier analysis explains.
The Race Against the Freezes
Of the stolen total, $3.46 billion, or 54%, was in stablecoins, which are digital dollars that their issuers can freeze.
So the thieves hurried to swap them for assets that cannot be frozen. On Ethereum, Tether froze the stolen USDT 37 minutes after it arrived, but not before 434 million USDT had been swapped for ETH.
On Tron, 234 million USDT was swapped into TRX before the rest was frozen. Circle froze all 823 million USDC before any of it moved. In total, about $786 million of stablecoins escaped.
Anyone following the North Korea Binance hack should note one more detail: the 18,270 bitcoin stolen was split into 19 addresses within half an hour and has not moved since.
How the Money Is Moving
The day-by-day record of the laundering is fast but follows a pattern. Late on 31 October, the FBI named a group called TraderTraitor as responsible and published the attacker’s addresses.
| Date | What happened |
| 29 October | Theft, freezes and first swaps |
| 30 October | One wallet began spreading 684.6 million TRX across roughly 7,700 accounts, then through six bridges into ETH |
| 31 October | New routes opened, including a “freeze-free” stablecoin and a lending vault; activity peaked near 1,300 transactions an hour |
| 1 November | Tron went quiet after 1,113 transfers in 51 hours; NEAR, ETH and SOL began to move |
| 2 November | All 233 million XRP moved to six new addresses |
The thieves combined several standard tricks:
-
Splitting funds across thousands of new accounts
-
Hopping between blockchains through at least seven bridges, which turn an asset on one chain into another
-
Swapping between assets so the trail keeps changing
-
Passing funds through a lending vault, a pool where users deposit coins to earn interest, so no direct transfer links sender and receiver
Analysts call the process clearly automated, but they have seen no sign that an AI agent is making decisions.
A First: Coinjoin Mixing Appears
Since 1 November, some stolen bitcoin has gone through coinjoins, which merge many users’ coins into one transaction and break the visible link between what goes in and what comes out.
By early 2 November, about 28 BTC, or $2.2 million, had passed through 18 coinjoins, each with 101 to 491 inputs.
That is small next to the whole theft. Even so, it matters, because mixing was not used earlier, and it suggests the thieves may now try it on the large bitcoin holdings.
In the North Korea Binance hack, those untouched coins are the biggest prize still unmoved.
Where the Funds Are Now and What Comes Next
About $3.24 billion remains in linked accounts, mostly bitcoin and the ETH held in nine large ones, which together hold 89% of the stolen ETH and have not moved since 30 October.
Those funds are very likely still held by the attackers. Funds already being laundered may have passed to Chinese money-laundering networks, which on-chain data cannot confirm.
About $16 million also went to addresses that hold proceeds of the September Bitget exploit, which is also linked to TraderTraitor.
Cashing out is the hard part, because it needs an exchange or an over-the-counter broker.
After the Bybit theft in February 2025, all stolen ETH was laundered within ten days, but cashing out took months, as this follow-up on Bybit shows.
This time the pace is slower, since the sums are more than double and the FBI has published the addresses.
Further freezes will be harder, because 44% frozen is unusual: only about 3% was frozen after Bybit.
On the recovery side, the exchange said on 1 November that it had covered about 95% of the impacted amount and that BTC, ETH, USDT, BNB, SOL, USDC, XRP, and several other balances are fully backed.
Its fourth update said withdrawals would resume in phases between 06:00 and 09:00 UTC on 1 November, and a full post-incident report is promised.
Readers should also beware of address-poisoning scams, where fake tokens are sent from look-alike accounts.
These are not controlled by the thieves. A free blocklist of linked addresses is available to businesses.
Conclusion
The North Korea Binance hack has moved from a smash-and-grab to a slow laundering campaign.
About 44% of the loot is frozen; the exchange says its users are covered, and the biggest question is how long the untouched bitcoin and ETH can stay out of sight.
Use only official channels, check details yourself, and expect further updates as the funds move.
Disclaimer
This article is for educational and informational purposes only and is not financial, investment or political advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research before making decisions.
